Privacy Policy

1. Information We Collect

1.1 Parent Account Information

• Name and email address
• Password (encrypted)
• Phone number (optional, for account recovery)
• Payment information (processed by Stripe, not stored by us)
• Account preferences and settings

1.2 Child Profile Information

• Child's first name or nickname (last name not required)
• Age (to verify 13+ requirement)
• Access PIN (for child login)
• Conversation history with Alura AI
• Topics of interest and usage patterns

1.3 Automatically Collected Information

• Device information (browser type, operating system)
• IP address
• Usage data (pages visited, features used, session duration)
• Cookies and similar tracking technologies

1.4 Crisis Detection Data

2. How We Use Your Information

2.1 Primary Uses

• Provide the Service: Enable AI conversations and parental monitoring features
• Safety Monitoring: Detect potentially concerning content and generate alerts
• Account Management: Process payments, manage subscriptions, provide support
• Communication: Send alerts, notifications, and service updates
• Improvement: Analyze usage patterns to improve our services

2.2 AI Processing

Your child's conversations are processed by our AI system (powered by Anthropic's Claude) to provide responses. These conversations are:

• Stored to provide conversation history and context
• Analyzed by our keyword detection system for safety monitoring
• Subject to AI provider terms (Anthropic's data handling policies)
• Never used by Alura to train AI models

2.3 Legal Compliance

We may use and disclose information as required by law, including:

• Responding to subpoenas or court orders
• Reporting suspected child exploitation to NCMEC (mandatory under 18 U.S.C. 2258A)
• Cooperating with law enforcement investigations
• Protecting the rights, safety, or property of Alura, users, or the public

3. Data Retention

Why 7 years for crisis data? We retain crisis alerts and safety logs for 7 years to:

• Comply with potential legal requirements
• Support law enforcement investigations if needed
• Provide documentation for child welfare purposes
• Enable parents to access historical safety information

4. Data Sharing and Third Parties

4.1 Service Providers

We share data with trusted service providers who assist in operating our platform:

• Anthropic: AI conversation processing (Claude API)
• Supabase: Database and authentication services
• Stripe: Payment processing
• Resend: Email delivery services
• Vercel: Application hosting

4.2 Legal Disclosures

We may disclose information:

• To comply with legal obligations
• To respond to lawful requests from government authorities
• To NCMEC when we detect apparent child exploitation (legally required)
• To protect the vital interests of any person

4.3 What We Do NOT Do

• We do NOT sell your personal information
• We do NOT share data with advertisers
• We do NOT use your data for targeted advertising
• We do NOT allow third parties to collect data for advertising

5. Children's Privacy (COPPA Compliance)

5.1 Parental Consent

By creating a child profile, parents provide verifiable consent for:

• Collection of the child's conversation data
• AI processing of conversations
• Safety monitoring and alerting
• Storage of activity data for parental review

5.2 Parental Rights

Parents can at any time:

• Review their child's conversation history
• Delete conversation history
• Modify their child's profile
• Delete their child's account entirely
• Request a copy of all data we hold about their child

6. Your Privacy Rights

Depending on your location, you may have the following rights:

6.1 Access and Portability

You can request a copy of the personal data we hold about you and your children.

6.2 Correction

You can update or correct inaccurate personal information through your account settings or by contacting us.

6.3 Deletion

You can request deletion of your personal data, subject to:

• Legal retention requirements (crisis logs, NCMEC reports)
• Legitimate business needs (fraud prevention, dispute resolution)
• Active subscriptions or outstanding payments

6.4 California Residents (CCPA)

California residents have additional rights under the CCPA, including the right to:

• Know what personal information we collect
• Request deletion of personal information
• Opt-out of the sale of personal information (we do not sell data)
• Non-discrimination for exercising privacy rights

7. Data Security

We implement industry-standard security measures to protect your data:

• Encryption in transit (TLS/SSL) and at rest
• Secure authentication with password hashing
• Regular security audits and vulnerability assessments
• Access controls and audit logging
• Secure data centers (via Supabase/Vercel infrastructure)

While we take reasonable measures to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

8. Cookies and Tracking

We use cookies and similar technologies for:

• Essential Cookies: Required for authentication and core functionality
• Analytics Cookies: To understand how users interact with our platform
• Preference Cookies: To remember your settings and preferences

You can manage cookie preferences through your browser settings. Note that disabling essential cookies may prevent you from using certain features.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on our website
• Sending an email notification to registered users
• Displaying a notice within the application

Your continued use of Alura after changes are posted constitutes acceptance of the updated Privacy Policy.

10. Contact Us

If you have questions about this Privacy Policy or want to exercise your privacy rights, please contact us: